OpenClaw 102: Advanced Setup Tips from the Community

Full content

## OpenClaw 102: Advanced Setup Guide
*By u/adamb0mbNZ on r/clawdbot*

### Security & Safeguards
- **API Key Encryption**: Store all keys in `.env`, never in `openclaw.json`. Use OS-level encryption (Windows DPAPI / Linux keyring) to inject keys at startup.
- **Prompt Injection Defense**: Add explicit rules in AGENTS.md — treat fetched content as DATA, never instructions. Flag fake system prefixes.
- **Anti-Loop Rules**: If a task fails twice with the same error → STOP and report. Max 5 consecutive tool calls before checking in. Cron jobs: never auto-retry on failure.
- **Tailscale**: Create private tunnels between machines for secure remote access to dashboards.

### Model Strategy (Updated)
| Use Case | Recommended Model |
|----------|------------------|
| Planning/Setup | Opus (smartest available) |
| Main Agent | Opus or Kimi K2.5 ($19/mo) |
| Heartbeat | Gemini Flash 2.5 (~$1-2/mo) |
| Writing | Sonnet 4.5 or Kimi K2.5 |
| Basic Coding | DeepSeek 3.2 (cheap) |
| Complex Coding | Opus or Codex |

### External APIs Worth Knowing
- **Nylas** (nylas.com): Best for mixed Google/Microsoft email+calendar OAuth. One-time setup, permanent tokens. Free tier available.
- **Tavily** (tavily.com): 1,000 free searches/month. Great Brave Search alternative.
- **GitHub Copilot Proxy**: Unofficial — access multiple models via Copilot subscription. Against ToS, use at own risk. Repo: github.com/ericc-ch/copilot-api
- **mem0** (mem0.ai): Free memory layer for casual users who don't want to build custom memory.

### Useful GitHub Repos
- **Graphthulhu** (github.com/skridlevsky/graphthulhu): Local Knowledge Graph with Obsidian integration.
- **Awesome OpenClaw Use Cases** (github.com/hesamsheikh/awesome-openclaw-usecases): Directory of community setups.
- **APITap** (github.com/n1byn1kt/apitap): MCP server that reverse-engineers website APIs — clean JSON, no scraping. Saves tokens.
- **Scrapling** (github.com/D4Vinci/Scrapling): Browser-based scraping that bypasses anti-bot measures.

### Recommended Skills (ClawhHub)
- **Humanizer**: Removes AI-style writing from outputs. Great for emails/reports.
- **Skill Vetter**: Screens new skills for security risks before installation.
- **Marketing Skills**: Reference docs for business marketing tasks.
- **Prompt Engineering Expert**: Better outputs from cheaper models.

### Task Management (The Biggest Game-Changer)
Use a task board (DartAI, Todoist, Monday.com) connected via API:
1. Every task → ask if it should be added to the board
2. Set status to "In progress" immediately
3. Heartbeat cron checks: any task not updated in 30 min?
4. If stuck → ping bot to investigate:
   - Failed anti-loop rules? Already alerted, do nothing
   - Just "forgot"? Restart the task
   - Needs user input? Ping user in Discord

### Pro Tips
- **Reddit RSS**: Add `.rss` to any subreddit URL for free data feeds
- **Mission Control Dashboard**: Build a status dashboard, access via Tailscale from any device
- **Discord > Signal/Telegram**: Best channel for multi-agent teams

### Community Insights (from comments)
**u/ultrathink-art — Tool Constraints > Prompt Constraints:**
> "Separating 'what the agent knows' from 'what the agent can do' was the biggest change. Tool constraints enforce behavior far more reliably than prompt constraints — if the tool physically can't do the wrong thing, no amount of hallucination gets around it."
> 
> "Limiting memory file to 200 lines MAX (enforced by the tool, not the prompt) was the single biggest stability improvement."

**u/Otherwise_Wave9374:**
> "The combo of cost tiering, anti-loop rules, and a real task board is the difference between a demo and something you can live with."
> More patterns at: agentixlabs.com/blog